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REMARKS 

1 he f- \aminet has objected to ( ianv? t due to mformahtie e VpplKam 
tcspeufulk note-- that suJi objection has been voided sn \!e\\ oi the amendments made 
to Claim 3. 

I he I xammet has rejected C aims M ^ 12 14-10 21-24 2b 30- ^ 37-40 
.14, sVs6 60 <>2-67 6«>-72 76 ? SS-ytf 92 4 j -<>*,, and ^ undu ^ I, S ( 

10 \a} as being unpatentable ov et C <v/ t j jPS Patent No ^ 64s\itsK i tn \ iev\ of \mold 
eta! (i S Patent No ^ 442 6°^ and timber in of Pienek ( Peeim*.* Inside the PL 
A Tout of the \\ hi ^ Pottahle f\e\ usable" ) Applicant lespectfulh disagrees \\ tth sudi 
rejection. 

To establish a pti>i>j Ailu case of obviousness llnce bjMt cutena inust be met 
Hrst there must be some suggestion or motivation, eithei in the ietereneet them^el\e» or 
m the know ledge geneiallv available to one oJ oulmaiv '■kill m the an, to modik the 
tcfeience oi tn combine tcfeience teaehitii-S Second these must Ix a seasonable 
expectation o( access 1 tnalk the jhsot an ufetenee (oi teieientes when eoinbined) 
must teach ot suggest all the claim limitations Hit teaching oi su&gostton to make the 
claimed combination and the reasonable expectation of success must both be found in the 
pnoi ait and not based on applicant s disciosiste In ie \ aeek ( ">4? F 2d 488. 20 TSP02d 
1438 fFed.Cir.1991). 

\\ ith i expect to the thai element of the;;/ /*/ fa- n case of obviousness and tn 
paitKnlai the obviousness ofeonibnuna the aforementioned lefeienees the L\aminer 
has argued that " it vvould hav e been ob\ ious. to the oidmai\ person skilled m the art at 
the time of [thej invention to emphn the teachings oi \moid ni the \miv- ^canning of 
Cozza b\ ci eating hashes of the data including the le-somees of the compiessed file and 
compaimg it to hashes oi known v>tal patterns " To the contiaiv applicant lespectfuiiv 
asserts that it would not ha\ e been ob\ tous to combine the- teachings of the C ozza and 
■\moid tefet enees espeualk m \ few of die v^st ev idence to the eonOaiv 
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The mere tact that tetercnees can be combined ot modified does not lendci die 
iesukant combination obx ioib unLss the juiot att aKo suggests the deMiabilm of die 
combination in to Mills, 9 J 6 F 2d oRO i 6 I M'Q2d 1 4 *0 (Fed Ot 1«<)0) Although 
pi jot ait dex ice "nia\ be capable of being modified to mn the \\a\ the appaiatus is 
claimed, thetc must be a suggestion or momation m the it-teience to do so '> !<> 1 2d at 
682, 16 USPQ2d at 1432 ). 

Applicant respectfully points out that the Cozza reference teaches that u [i]f [there 
i» a] need to scan for one or moie \ irtises then a check us nude to see whether the tile is- 
compteascd" {C ol 7 lines lo~S i ;) ( o//a fir.thei discloses that 1 [a] compter d file ma\ 
base aliead\ been decompi essed but that |ijf tlx file does tequne decompie >\ion. then 
u is dccompiessecP (( oiumn 7 ! mes 20-2 1) In fact, ( o//a onl\ caches that aftci such 
deiofflpiession the tile is scanned tsee steps 84, ^6 0(J and s>4 m Fiauie 4D of < o//a} 

However, the Arnold icfetence meieh i elites to 'automaUc[allvj seaTchjmg j for 
one ot moie patterns \\ htch ma\ he contained w nhm a hod\ of text oi computer data in 
cnciypted iomi and mote paiticidaih to seatehmg tot eita\ptcd pattern-, within 
computet \ irusc-^ f,( olunin 1 lines 1 8-22 emphasis added! In fact applicant 
iespectiiilh points out that \muld expresslv discloses ' detecting] and l<">eat[ingj patterns 
that ate piesent w ithm data that has been enmptcd (see Absttact), whete ' foi those 
patterns whete it is of interest to detect m the leu 1 1 encixptions of the pattern lathei 
than just the pattern itself te g patterns trom seif-etietvpting compute! mi uses), the 
signatutes ma\ be subjected to an nuauant tiansfotmation apptopuate to the txpe ot 
encn puon' KV1 4 hues 10-45 1 death Arnold oitlx teaches searching fVi patterns 
\\ithm encrypted data To this end theie would ha^e been no motix ation oi suggestion to 
combine \tneid. which oi)K relates to seaiching for patterns within enaxpted data . x\fth 
the teachings of C ozza, xxluch onK ^cans data aftei such data is decompressed 1 has, the 
bvammei V pioposed combination is mappiopnate 
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I uitlKr the iact that ( o//a teadics that decompression takes place beloic 
seannma 1oe \ miscs attualh 'V^ mi 1/5 fiom c i eating hashes 01 data 01 the 
comptessed file 1 m oidet to 1 scan the files as qutekh a e possible (emphasis added) as 
alleged h\ the f \ unmet to be taught tn \tnold It is mipi opet to combine leleicuccs 
whete Uie iL.fe.tene.es teach awa\ fiom then combination /" w <iio*.\c,'h ~P J 2d I 
21SrSP0~V> tir I *>f -5 > 

1 hus applicant icspecttulK asserts that the fust clement ot the P'lttu ja< le case of 
oln iousncss ha-, not been met as noted aboxe 

Mote nnportamh, ipphcant <Ao tespccUullv as;erts that the thud element of the 
p tn\i Ukk case ol om Juttsue-o hao not been met b\ the ptiot art jefetence esxeipts 
idled on bs th* kAanunet F01 exampk with icspect to tlK independent claims the 
1 \<munei has tched on ( oi 2 lines c 4-(^ and <""oi 6 lines 6-4^ hom the t. o//a 
refeitnce to make a pi 101 art show am of applicant's damud 'reading tesoiiR^ data 
within said packed computet hie s<nd tesoutce data bpeuhmg piogtam tesouice item-> 
used b\ said known computet piogtatrs and leadablc b\ a computet operating swem 
without dependence upon which unpacking ilgoiithm is u-ed b\ said packed computet 
hie' (seethi^oi snmlai but not ncce^sai J\ idctuicaHanguagc m the mdtpendtm 
claims). 

\pphcant icspectttilK ascertc. that the abc^e icterencc eunpts teli-d on b\ the 
1 \ammei met eh leach that the file s cache inlounanoit is cheeked tn see tl 11 is marked 
as ha\ mg been pre\ loiioh infected b\ sonic \uus which change*- a tile's tesouuc iotk 
s]/e ' (t ol o lines 2 1-2 > empha-as added i and that 1 [ijt a iile's cat. he information is not 
marked as hax ing been pu\ ioui>!\ infected tln.11 the file';, tun cut ie i ^ca i !ti i cc iii t i ork iiii ^ i tyc io 
compated w ith the icsoutce + oik s! 'e stored in the file - cadie tniotmaifon to see it 
the\ are a uhui some predetet mnied toleiance (( ol <>Jme c 21-2> emphasis added) 

I uithei the e\cetpts teach that ' th^. resource, folk ruav contain a kind of small 
database which is used to contain manv kinds ol data mciudmg application code icons 
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pteteieoces jm;)^ templates and other such items' <{\>1 2 Jiuls -Hi-dO anphaMs 
added) Also the excetpts disclose that 1 [i]f the compies^ed file si/es aic diftctent oi 
if these ate sume \nuses that could infect this file without changing its completed si/e 
then fork sj/c- mtotmation fos this file is obtamtd " whseh. 'could imohv. decomposing 
tho fsie opening the file of executing some special system ot othci c<xle in «tdet to 
obtain thi» information" {To! <~> Imes 14-20 emphasis added) 

Ho\\v\er meieh disclosme eompaimL* the u source (oil size with a cached 
itsomce tbik si/e , uheie the iosouko iotk ma\ contain a -mail database including 
application code, icons pufeienees. stunys, and templates as m (. cvza fails to teadi 
1 reading lesource data v tthm said packed computet file >atd lesouice data specifying 
puymain lespune items used In said known lomputei piouauf (emptiaM , added) in the 
context claimed In applicant ^urthu t mciclv tcailim,L f that fbiK size mfuimatton fui a 
fde ma% be obtained b\ decompiessmg the file opening the bie 01 e vet mine some 
special ssstcm as m Co/za at >e^ nut teach " eadmg Ksontce data within Mid packed 
compute* lile said tesouRC data loadable bv a computer opeuumg .a stem w ithout 
dependence upon whiih. unpacking a uoiithm i g used b\ said packed computet hie 1 
temphasb added) in the contest elamied b\ applicant 

Finthei ^uli the Pvt miner has aiguee that Co// a teaehes that '"the compassed 
file is not docompiessed in oider to ie<ul the iomiujcc iotkb mfoiiiiauon ' Applicant 
iCspecttulK disagrees ana note* that Co/za teaehe3 that "foik size infoimation tor this 
file is obtained and that ft {has could nnohe dec-ompicssing the hie t( ol o hues 

1 9 ----- emphasis added). 

\dditionall> with tespeu to the independent claims the h\ammei has relied on 
"Rl~ SFORKLf \ m figure ^ ot Co// a m addition to Co! 2 hncs in C«v/a to 

make a pnoi ait showing of applicant .s claimed technique w net em said geneiated 
fingerpuni data includes a numbei 0} piograns tesouicc items specified within c«aid 
iesouiee data of said packed computet file (we thi3 or smulat, but not necessanh 
identical language in tite independent claims 1 



Applicant respectfully asserts that "RESFORKLEN" in Figure 5 of Cozza simply 
relates to a file resource fork length , as shown in Figure 5, where such length is defined 
by an associated size in bytes. Clearly, only disclosing a length of a tile resource fork in 
terms of bytes, as in Cozza, fails to specifically meet applicant's claimed technique 
"wherein said generated fingerprint data includes a number of program resource items 
specified within said resource data of said packed computer fiie ,: (emphasis added), as 
claimed. 

In addition, C ol 2. hues m Co/za oimpK discloses that 'one folk of a 
file may contain a kind of small database which i; u?ed to contain manv I inds of data, 
including application code. leons pi efuenee=, stnngs templates, and oi.hu such items * 
Howcaci simpK disclosing that a file ma\ tontam manv kinds of data as m Ot/'a fails 
to suggest a technique v\ herein said geneiatcd finueipnnt data include^- a numhei of 
piogtam fesoutee items specified w ithm -,aid tesouice data of satd packed computer file" 
(emphasis added* as claimed b> applicant 

Still \ct the I xanunei has argued that 'tji would ha\c been oln ions in this 
combination that because the file contains the itsoiuce fink and asouice items and the 
hash is tal>en o{ the file the signature includes a number of tesourcc items specified 
within the resource fork." 

Applicant lespecttuilv disagiees and asseits that applicant claims that said 
tesouice data ol said packed computet file is ptocessed to geneiate fiogetpimt data" 
wheie satd generated finmpiun data includes a number of progiam lesoutce items 
specified w uhm s<nd K\->outce data uf said packed computet file " when tcad in context 
C leaf h the fin^eipunt claimed In applicant is gent rated Oom processed resouicc data 
in the context claimed and is not mere I \ a hash of a file that includes the resouicc tork 
and lesouice uenu as alleged b\ the L\atnmer Thin, it w onld not ha\ e been ob\ mils 
fbi \aid genciated fuigupnut data [to include] a numbei of psotnam sesoutce items 
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specified w ithm said resource data of said packed computer file," in the context applicant 
specifically claims 

Futfhei, the Fsammet has relied on Hguie 5 m H>//a to make a pnot art showing 
of applicant s claimed technique *w herein said geueiaied fingcipunt data includes a Hag 
indicating which data is included w uhm oaid generated fingerpnnt data (sec this oi 
smulai but not necessanh identical language in the independent chum) 

Applicant respectfully asserts that the only "flag" shown in Figure 5 of Cozza is 
simpK utilized t(> indicate die presence of a \ trus hi addition, applicant points out that 
die flag is included m a scan information cache Hie which 'includes; data thai has been 
accumulated during die scanning of files t(\>! 5. lines 17-21} Heath , a flag that 
indicates whethci a \»us is ptesent m scanned data as m Co//a fads to leach that 
" generated fmgei pi mi data includes a flag indicating which data is included within said 
generated fingerprint data " t emphasis added) as claimed 

Moreover, the Lvimmci has argued that ' i]t fuithei would have been ohsious 
that because the hngetpi uu data tepiescnted the file during comparison, ami the Hags of 
C o//a indicated the vnuses found in the file the finaetpunt data would have included a 
llag indicating which data {mi uses) was included within said finger pi nit data ' 

\pplieanl respectful h disagrees and again abseils that applicant claims thai said 
jcooutce data of said packed computer file is proceed to ueiieiate fingerprint data" 
where ' «afd generated finger pum data mchic.es a Hag indicating winch data is included 
within sasd yeneiaied fingeipnnt data ' whei read in context ( SeaiK the fiuLvipunt 
claimed h\ applicant is geneiated horn processed resource data , in die context churned 
and is not meielv lepicsentame of the file during companion as aikgtd b\ ihe 
bXammer 1-uitheimoie applicant re»pectfulK assetts that the flags dusclo^ed in ( ozza 
are onh included m the scan intoimauon cache file v\ Inch " include^ data drat has been 
accumulated during die »cannmg of fikV (ste Col ^ lines 1 7 - i 0 ju Cozza i, and not m 
the file rtsell m w inch a \ uus was Sound 1 o this end even a hash oi the iile that includes 
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the \iRisc-s would nut itself mdude a flag indicating am .->ou of \uu>ej. as argued b\ the 
Fvammct 1 litis it would not ha\e heui ob\K>u» fui "said geneiated fingupimt data [10 
include) a flae indicating which data ts included withm said uenetated fmgerptmt data 1 
in the context claimed. 

Still \et with icspcct to the independent claims the txammet has uhed on the 
(olhnvmg exceipt iiom the C o//a ieieTence to make a prior ait showing of applicant s 
claimed technique k w herein said genet died iingcipunt data nu hides a location within 
said lesource data of sjjd packed computet file oJ an enti) ^pectfwng a piogra.ni tesoutce 
item ha\ utir a largest sizt, {see this oi .similar, but not necessanh identical language m 
the independent claims). 

for fc sizo, ::;;er. the file's current resource fork size is compared 
with the resource fork size stored in the file's cache 
information in step 66 to see if they are within some 
predetermined tolerance. The tolerance in this i.tep is determined 




Applicant respectfully asserts that the excerpt from Cozza relied upon by the 
nviminer met eh disclose^ companng v the {lie's euneni tesomcc foil si/e with the 
le^oiiicc foik si/e stoud in the fde\s (.ache mfuimatson in sup C>0 to see if the\ are within 
some niedetoi mined tolerance ' (emphasis added} ( learlv stniph disclosing cheeking a 
cuiicnt oi staled iesuuiLc foik st/e <is in ( Q//& fails to even mislW a Rchnsijiie 
'wheiem said genu ale J fmgi'tpimt data mi lades a location withtn ^aid tesouicc data of 
said packed computet File oi an euttx speeds mg a pio^iam lesoutce item Inn trig a largest 
size' fempha»ss added), ai> claimed b\ applicant 
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Moieowj with respect to the independent claims the I xammei has telied on 
Figine ^ from ( o//a and Page 2 i . "Pi File Rase Relocations ' m Pseuek to make a ptiot 
art showing of applicant's claimed technique ' whetem said uenetated fingerptmt data 
includes a checksum \ afuc calculated m dependence upun a numbet uf ptogmm 
ic-^oiiiee items specified beneath each node v.ithtn lueiatchtcailv aiidiiged lesource data 
of said packed computet file' tsee thio or similar, but nut nece-^sank identical language 
in the independent claims). 

Applicant respectfully asserts that the excerpt from Cozza relied upon by the 
LXaminei meteh discloses "\ache data sttucaires ' wheie a 1 ne\\ cache includes data that 
has been accumulated durmg tht scanning- of tiles, data about the cache ibeli , ) e its 
\CiHon. \olume creation date file id and checksum , and scan mfoimation foi each file 
scanned " (Column 5, lines 17-21 - emphaois added) -\ddttionalh applicant notes that 
theevceipt horn Picttek relied on b\ the I vimmct mereh teaches that * [wjhen the linker 
cieates an h\h tile it makes an assumption about uheie the file will be mapped mtu 
niOTiin' and v [bjrused on this the htiket puts the teal addie^cs of code and data items 
into the executable file" (Page 21, "PE File Base Relocations" paragraph I). 

However, merely disclosing a cache data structure which includes a cache 
checksum, m addition to teaching that a hnkei puts code and data into an executable file 
fails to e\ en <■/ a technique v wheiem said geneiated fmgci print data includes a 
checksum value calculated m dependence upon a numbes of piogram icsuurc- items 
specified beneath each node \\itSnu hteiaichicail\ arranged lesoutce data of said packed 
computet flic- ' {emphasto added) as claimed K applicant 

\dditionalK the Examine! has digued that it would have been ob\ ious that the 
checksum of the file m this combination wohld ha\e been dependent upon a uumbet of 
sasd pmgram sesuuiee items specified beneath cadi node wrthm hieratchicalK ananged 
sesouice data ol said packed eotnputet file as Pietiek teaches that \\ im>2 Pf files ate 
aitanged m sueh a tnannet as seen [in] Ptettek I ig ^ and (able 1 ^ " 
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-Vppli^ant le^pectfitiK dusagieet* and points out that I tgure 5 and Table L> fiom 
Pietrek merek show a tesouicc diieetoix hieiaichx example and the le^outces hteiaichv 
foi C I OOK KXf- Howevei. the taNe and ftguie tdted upon b> the hxaminei tn no \va\ 
suggest ' fingerprint data [that] includes a checksum value calculated in dependence 
upon d uumhet of piogtam lesnntee items spec t Tied beneath each node within 
hietatchicalh ai ranged iesouree data of said packed computei tile" (emphasi? added), as 
claimed by applicant. 

Applican t respectfully asserts that at least the first and third elements of the prima 
fiKtt case of obviousness ha\e not heai met since it would he i/voh'iow* to combine the 
references, at, noted above and the pnoi <jtt rcletence excerpts as tebed upon b\ the- 
b vammei fad to teach or biggest ajl oi the claim h nutations, as noted above 1 bus a 
notice of allowance orapropet prior au showing of a]| of applicant \s Jatm limitations, in 
combination w !tb the temammg eiann elements, us respectfully requested 

\pphcunt Uuthe! note.-? that the pnot an ts ah-o deficient with respect to the 
dependent claims i j oi example, \\ uh respect to Claim 12 et ai the f \anunei has icbed 
on the field \ l)l i '\trCR_D-VTT m figure ^ from the Co//a referc-iKC to make a prior ait 
showing of applicant s claimed technique "whetein .said genetated ftngeipunt data 
include- timestamp data indicative of a time oi compilation of said known computet 
program," 

Vpplicant lespeufulh asseits that the ftgme funn (\v/a tebed iiputi b\ the 
1 \ammei metcK teacher a field \ OI I MbCKD \i I that icpiesents tlu "citation date oi' 
[a j x ohime on which [a] file icstdes ' the field being pan of the Macintosh scan 
iiifoimatton Cache File Mukuue' fhg Howevei metelv disclosing a field 
desci ibmg the eteation date of the volume tn wine h a file tcsidcs, as in 1 o//a, *aiU to 
teach a technique ' wherein said genet ated fiiigeipnnt data includes umestamp data 
mdicam e of a time of lonipiluum of said kiumn computer urogram (emphasis 
added) ;*s claimed b\ applicant Futtbei applicant respect fullv points out that tn the 
OlfKt' \etioft dated 00 01 2006 the fc \aimnei even admitted that ' [f he combination oi 
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C o//a and ! h ppune n Ruled to dispose pun ldiny a time of compilation in the 
Fmiierpiinf data" (emphasis added) Tku> C o//a »nnpk does not meet applicant's 
specific ciatm ianuuaue. 

!ij addition with icspect to dependent Claim 14 et al the i \ammei has admitted 
that t o//a, Arnold and Pcuek do not disclose applicant s specific claim ianauaue and 
thus has simph dismissed the same midta Official Notice SpeufiealK the INamtneT has 
argued that " SH -V whKh shifts i hit to die iett alar each opetauon wa, a well known 
checksum m the ait at the tmie oi the nt\ cation and as such it w ould base been ab\ tons 
to the outman pet son skilled in the art to b<; used SH \ as the checksum 

\pphcant iespectrlilh disatnees and assess that exct) asMtmiiiU unincfhio that it 
would hu\ c been ob\ iou» to shift 1 bit after <.ach operation m calculating a checksum 
such still doe,-, not addtess applicant's specific iJairo iatitmayc nameh thai ^atd 
checksum value is jotated between each item hemu added into said cheeUunf (emphasis 
added), as claimed Thus, applicant s clatmecl technique snnplv would not ha\ e been 
obvious. 

Vppli^ant thus loiniaiK requests a specific showing of tin. subject mattu m \\ I 
oi the claims in anv future action Note e\tupj iiom MPfP below 

it the applicant tta\ers^s su<.h an [Official Notice" asset tion the evtminet should cite a 
icfetenee in support oi his or hct position See MP! P 2144 (^ 

Wain suite at least the First and third elements of the puma In. a. case oi 
ob\u>usness have not Ken ma as noted abo\e a notice of allowance oi specific pnoi att 
show iiiy of each of the totegomg claim elements m combination w uh the remaining 
claimed featuies, jsie-spectfuiK requested 
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To tin? end. ail ot the independent claims au deemtd alhnvabk Moiecnei. the 
lemainmg dependent claims are +uithei deemed allowable iinie« of then dependence 
on such independent claims 

hi the event a telephone comeisatuiu would expedite the ptoseamon of this 
application the J~\ammc! max teach the undei signed at t lost >05- < i 1 00 The 
Coinnussiuitu is authorized to charge my additional fees ot credit am o\ etpax mem to 
Deposit Woimt No 50-1351 (Oidei No. NAHJM07). 

Respectfully submitted 
ZilU-kotab VC 
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